1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
|
Script to help make sense of log output from popular SSH honeypot [Cowrie](https://github.com/cowrie/cowrie/). I think I got carried away with the specialized logging settings. Only tested on my setup. Untested with Telnet. YMMV
# Usage
```
cowrieder.py <args> filepath
```
Options:
```
-h, --help show this help message and exit
-v, --verbose Make the output more verbose (print abridged logs for all logins where commands are run, not just the interesting ones)
-vv, --verboser Make the output even more verbose (print timestamp, event id, and message (if applicable) for all events)
-vvv, --verbosest Make the output even more verboserer (just group the input log by session id and dump it to pretty-printed JSON)
-B, --blank On default and low verbosity, print nothing whatsoever. Override this with other arguments to filter for only the stuff you care about
-P, --pings | With blank mode active, print "empty pings"
-F, --fails | With blank mode active, print failed logins
-L, --logins | With blank mode active, print "login pings"
-C, --commands | With blank mode active, on default verbosity, print "command pings"
-S, --sessions * With blank mode active, on default verbosity, print "interesting" sessions. With -v enabled, this and -C do the same thing.
-a, --stats Print aggregated statistics
-j, --json-stats Dump aggregated statistics as JSON
-i, --filter-ip FILTER_IP
Filter data to a specific IP
```
# Terminology
- "Empty ping": Client connected and made no attempt to log in
- "Login ping": Client logged in successfully and did nothing
- "Command ping": Client logged in successfully and only ran `uname`, `nproc`, and/or `echo`. In my experience "command pings" comprise most insances of a client successfully logging in and then bothering to run any commands
|
